This invention relates to a complete and transportable security device having a network communications interface which provides encryption and authentication capabilities to protect data and restrict access to authorized users. The device can be carried by the user in a pocket or a purse.
The rapid growth in the use of distributed computing has caused a vast increase in the transmission of sensitive and vulnerable data on computer networks. This increase in private data on communications lines has opened network computing to substantial risk. These risks include the ability for unauthorized persons to gain access to networks or computers and for eavesdroppers to read proprietary data on the communications line. At the same time, there is an increased need for communications equipment to be compact and convenient so that it can be used with laptop computers and other personal computing equipment.
Data encryption is herein defined as a technique to protect the confidentiality of data to ensure that it is not disclosed or revealed to unauthorized persons. Device authentication is herein defined as a technique to identify and control access to a network or system by a specific device or "token." User authentication is herein defined as being similar to device authentication except that the user is identified instead of a device. Message authentication is herein defined as a technique which safeguards against the undetected modification of data in transit or the counterfeiting of data. Each of the aforementioned techniques can be based on either secret key or public key cryptography. The capability to perform this cryptography is herein referred simply to as encryption.
Data encryption has been used in the past as described in Ehrsam U.S. Pat. No. 3,962,539. Data authentication, which has been used in the past by banking and other financial industries, is a technique to detect any modification of communicated data.
The idea of authentication of the user by something the user possesses, such as a smartcard, or something the user knows such as a Personal Identification Number (PIN) or a biological attribute of the user such as a fingerprint, is known in the art. These methods have not, however, provided a complete communications security system to be carried by the user.
U.S. Pat. No. 4,546,213 describes a modem security device, but the device does not provide efficient encryption and authentication capabilities nor can it be carried as a "token" to control access to a computer network. Several methods of "authenticating" the user using "biological" attributes, such as fingerprint readers, retina (eye) scanners are known. For example, U.S. Pat. No. 5,153,918 describes a security system for data communications for securing access to a computer system using voice recognition as the access control medium. Similarly, Young and Hammon in U.S. Pat. No. 4,805,222 describe the use of operator keystroke dynamics to identify the user. Unfortunately, these methods have proven to be expensive for ordinary commercial use and have been considered to be inconvenient or intrusive by potential users.
Lessin, U.S. Pat. No. 4,868,376, incorporates a means of authenticating a user with a personal identification number (PIN). The Lessin security device is contained in a portable housing, such as a smartcard, but requires connection to a non-portable reader and does not include means for direct connection with a telephone network. U.S. Pat. No. 5,301,234 describes a radiotelephone installation for prepayment operation with security protection using encryption to authenticate the device, but the '234 reference discloses use of the device in conjunction with payment of services for radiotelephone sets--not digital communications security with data encryption. U.S. Pat. No. 5,239,294 describes a means of authenticating a subscriber's device to control access to cellular telecommunications networks, but is specifically directed to use with radio telecommunication systems.
It is, therefore, an object of the present invention to overcome shortcomings associated with prior art systems and devices. These objects will be made known to those skilled in the art from the following description.